Recombining modules for applications using a common provisioning service

ABSTRACT

The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of U.S. patent application Ser. No.15/639,375, filed Jun. 30, 2017, entitled “MODULAR APPLICATIONS USING ACOMMON PROVISIONING SERVICE,” (Atty. Dkt. No. 402757-US-NP), whichclaims priority to U.S. Provisional Pat. App. No. 62/503,787, filed May9, 2019, entitled “IOT EDGE PROCESSING” (Atty. Dkt. No. 402393-US-PSP).The entirety of each of these afore-mentioned application(s) isincorporated herein by reference.

BACKGROUND

The Internet of Things (“IoT”) generally refers to a system of devicescapable of communicating over a network. The devices can includeeveryday objects such as toasters, coffee machines, thermostat systems,washers, dryers, lamps, automobiles, and the like. The devices can alsoinclude sensors in buildings and factory machines, sensors and actuatorsin remote industrial systems, and the like. The network communicationscan be used for device automation, data capture, providing alerts,personalization of settings, and numerous other applications.

SUMMARY OF THE DISCLOSURE

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used to limit the scope of the claimed subject matter.

Briefly stated, the disclosed technology is generally directed to IoTtechnology. In one example of the technology, the following actions areperformed for each module of a plurality of modules on a first edgedevice. An identification message that includes information associatedwith identification of the module is received. The validity of themodule is then verified. After the module is verified, based at least inpart on the identification message, an IoT support service is selectedfrom a plurality of IoT support services. The module is then caused tobe registered with the selected IoT support service. The plurality ofmodules are compositable together into an application for the first edgedevice. The modules of the plurality of modules are capable of beingused interoperably with other modules without altering the othermodules.

Other aspects of and applications for the disclosed technology will beappreciated upon reading and understanding the attached figures anddescription.

BRIEF DESCRIPTION OF THE DRAWINGS

Non-limiting and non-exhaustive examples of the present disclosure aredescribed with reference to the following drawings. In the drawings,like reference numerals refer to like parts throughout the variousfigures unless otherwise specified. These drawings are not necessarilydrawn to scale.

For a better understanding of the present disclosure, reference will bemade to the following Detailed Description, which is to be read inassociation with the accompanying drawings, in which:

FIG. 1 is a block diagram illustrating one example of a suitableenvironment in which aspects of the technology may be employed;

FIG. 2 is a block diagram illustrating one example of a suitablecomputing device according to aspects of the disclosed technology;

FIG. 3 is a block diagram illustrating an example of a system for IoTcommunications;

FIG. 4 is a diagram illustrating an example dataflow for a process forIoT communications;

FIG. 5 is a block diagram illustrating an example of a portion of thesystem of FIG. 3;

FIG. 6 is a block diagram illustrating another example of a portion ofthe system of FIG. 3;

FIG. 7 is a block diagram illustrating yet another example of a portionof the system of FIG. 3;

FIG. 8 is a logical flow diagram illustrating an example of a processfor IoT communications; and

FIG. 9 is a logical flow diagram illustrating an example of anotherprocess for IoT communications, in accordance with aspects of thepresent disclosure.

DETAILED DESCRIPTION

The following description provides specific details for a thoroughunderstanding of, and enabling description for, various examples of thetechnology. One skilled in the art will understand that the technologymay be practiced without many of these details. In some instances,well-known structures and functions have not been shown or described indetail to avoid unnecessarily obscuring the description of examples ofthe technology. It is intended that the terminology used in thisdisclosure be interpreted in its broadest reasonable manner, even thoughit is being used in conjunction with a detailed description of certainexamples of the technology. Although certain terms may be emphasizedbelow, any terminology intended to be interpreted in any restrictedmanner will be overtly and specifically defined as such in this DetailedDescription section. Throughout the specification and claims, thefollowing terms take at least the meanings explicitly associated herein,unless the context dictates otherwise. The meanings identified below donot necessarily limit the terms, but merely provide illustrativeexamples for the terms. For example, each of the terms “based on” and“based upon” is not exclusive, and is equivalent to the term “based, atleast in part, on”, and includes the option of being based on additionalfactors, some of which may not be described herein. As another example,the term “via” is not exclusive, and is equivalent to the term “via, atleast in part”, and includes the option of being via additional factors,some of which may not be described herein. The meaning of “in” includes“in” and “on.” The phrase “in one embodiment,” or “in one example,” asused herein does not necessarily refer to the same embodiment orexample, although it may. Use of particular textual numeric designatorsdoes not imply the existence of lesser-valued numerical designators. Forexample, reciting “a widget selected from the group consisting of athird foo and a fourth bar” would not itself imply that there are atleast three foo, nor that there are at least four bar, elements.References in the singular are made merely for clarity of reading andinclude plural references unless plural references are specificallyexcluded. The term “or” is an inclusive “or” operator unlessspecifically indicated otherwise. For example, the phrases “A or B”means “A, B, or A and B.” As used herein, the terms “component” and“system” are intended to encompass hardware, software, or variouscombinations of hardware and software. Thus, for example, a system orcomponent may be a process, a process executing on a computing device,the computing device, or a portion thereof.

Briefly stated, the disclosed technology is generally directed to IoTtechnology. In one example of the technology, the following actions areperformed for each module of a plurality of modules on a first edgedevice. An identification message that includes information associatedwith identification of the module is received. The validity of themodule is then verified. After the module is verified, based at least inpart on the identification message, an IoT support service is selectedfrom a plurality of IoT support services. The module is then caused tobe registered with the selected IoT support service. The plurality ofmodules are compositable together into an application for the first edgedevice. The modules of the plurality of modules are capable of beingused interoperably with other modules without altering the othermodules.

IoT devices may communicate with an IoT support service to receive IoTservices, either communicating directly with the IoT support service orindirectly via one or more intermediary devices such as gateway devices.Edge devices may include IoT devices and gateway devices. Applicationson edge devices may be composed from modules.

In some examples, the modules are re-usable, e.g., they do not depend onbeing in a specific environment. Instead, the modules can be used withother combinations of modules, e.g., to form a different application. Insome examples, each module has the “illusion” that it is the only modulepresent, but can communicate with other modules, and with the IoTsupport service or other endpoint. In some examples, communicationsbetween each module in an application, and with the IoT support service,are all conducted according to a common security context provided by aprovisioning service to be used by the modules and by the edge devicehardware security.

While mass producing IoT devices, an IoT support service endpoint alongwith credentials are not typically hard-coded into the IoT device,because, for example, the device manufacturer might not know how thedevice will be used. In addition, correct provisioning may involveinformation that was not available at the time that the device wasmanufactured. Provisioning may be used as part of the lifecyclemanagement of an IoT device that enables “seamless” integration with anIoT support service, with each module being provisioned by the sameprovisioning service. In a manner of speaking, provisioning may pairmodules in IoT devices with a cloud backend based on a number ofcharacteristics such as: the location of the device, the customer whobought the device, and the application in which the device is to beused.

Some examples of the disclosure provide a provisioning service that is aglobally available cloud service that acts as a single global endpointfor modules in edge devices to connect to on the front end, hasconnections to multiple cloud solutions on the backend, and uses routingrules to make sure that modules in IoT devices are provisioned to theappropriate IoT support service. In some examples, the provisioningservice is a globally available cloud service that acts as a globalendpoint for modules in the cloud; in other examples, the provisioningservice is an endpoint within a user's subscription per serviceendpoint. The provisioning service may select an IoT support servicefrom among multiple IoT support services, and may provision the modulesin the edge device to the selected IoT support service. The provisioningservice may enable, for each module, the “seamless” creation of itsdigital twin in the IoT support service. In some examples, allconnections to and from the provisioning service are secured.

Illustrative Devices/Operating Environments

FIG. 1 is a diagram of environment 100 in which aspects of thetechnology may be practiced. As shown, environment 100 includescomputing devices 110, as well as network nodes 120, connected vianetwork 130. Even though particular components of environment 100 areshown in FIG. 1, in other examples, environment 100 can also includeadditional and/or different components. For example, in certainexamples, the environment 100 can also include network storage devices,maintenance managers, and/or other suitable components (not shown).Computing devices no shown in FIG. 1 may be in various locations,including on premise, in the cloud, or the like. For example, computerdevices no may be on the client side, on the server side, or the like.

As shown in FIG. 1, network 130 can include one or more network nodes120 that interconnect multiple computing devices 110, and connectcomputing devices 110 to external network 140, e.g., the Internet or anintranet. For example, network nodes 120 may include switches, routers,hubs, network controllers, or other network elements. In certainexamples, computing devices 110 can be organized into racks, actionzones, groups, sets, or other suitable divisions. For example, in theillustrated example, computing devices 110 are grouped into three hostsets identified individually as first, second, and third host sets 112a-112 c. In the illustrated example, each of host sets 112 a-112 c isoperatively coupled to a corresponding network node 120 a-120 c,respectively, which are commonly referred to as “top-of-rack” or “TOR”network nodes. TOR network nodes 120 a-120 c can then be operativelycoupled to additional network nodes 120 to form a computer network in ahierarchical, flat, mesh, or other suitable types of topology thatallows communications between computing devices 110 and external network140. In other examples, multiple host sets 112 a-112 c may share asingle network node 120. Computing devices 110 may be virtually any typeof general- or specific-purpose computing device. For example, thesecomputing devices may be user devices such as desktop computers, laptopcomputers, tablet computers, display devices, cameras, printers, orsmartphones. However, in a data center environment, these computingdevices may be server devices such as application server computers,virtual computing host computers, or file server computers. Moreover,computing devices 110 may be individually configured to providecomputing, storage, and/or other suitable computing services.

In some examples, one or more of the computing devices 110 is an IoTdevice, a device that comprises part or all of an IoT hub, a devicecomprising part or all of an application back-end, or the like, asdiscussed in greater detail below.

Illustrative Computing Device

FIG. 2 is a diagram illustrating one example of computing device 200 inwhich aspects of the technology may be practiced. Computing device 200may be virtually any type of general- or specific-purpose computingdevice. For example, computing device 200 may be a user device such as adesktop computer, a laptop computer, a tablet computer, a displaydevice, a camera, a printer, or a smartphone. Likewise, computing device200 may also be server device such as an application server computer, avirtual computing host computer, or a file server computer, e.g.,computing device 200 may be an example of computing device 110 ornetwork node 120 of FIG. 1. Computing device 200 may also be an IoTdevice that connects to a network to receive IoT services. Likewise,computer device 200 may be an example any of the devices illustrated inor referred to in FIGS. 3-5, as discussed in greater detail below. Asillustrated in FIG. 2, computing device 200 includes processing circuit210, operating memory 220, memory controller 230, data storage memory250, input interface 260, output interface 270, and network adapter 280.Each of these afore-listed components of computing device 200 includesat least one hardware element.

Computing device 200 includes at least one processing circuit 210configured to execute instructions, such as instructions forimplementing the herein-described workloads, processes, or technology.Processing circuit 210 may include a microprocessor, a microcontroller,a graphics processor, a coprocessor, a field-programmable gate array, aprogrammable logic device, a signal processor, or any other circuitsuitable for processing data. Processing circuit 210 is an example of acore. The aforementioned instructions, along with other data (e.g.,datasets, metadata, operating system instructions, etc.), may be storedin operating memory 220 during run-time of computing device 200.Operating memory 220 may also include any of a variety of data storagedevices/components, such as volatile memories, semi-volatile memories,random access memories, static memories, caches, buffers, or other mediaused to store run-time information. In one example, operating memory 220does not retain information when computing device 200 is powered off.Rather, computing device 200 may be configured to transfer instructionsfrom a non-volatile data storage component (e.g., data storage component250) to operating memory 220 as part of a booting or other loadingprocess. In some examples, other forms of execution may be employed,such as execution directly from data storage memory 250, e.g., eXecuteIn Place (XIP).

Operating memory 220 may include 4^(th) generation double data rate(DDR₄) memory, 3^(rd) generation double data rate (DDR₃) memory, otherdynamic random access memory (DRAM), High Bandwidth Memory (HBM), HybridMemory Cube memory, 3D-stacked memory, static random access memory(SRAM), magnetoresistive random access memory (MRAM), pseudostaticrandom access memory (PSRAM), or other memory, and such memory maycomprise one or more memory circuits integrated onto a DIMM, SIMM,SODIMM, Known Good Die (KGD), or other packaging. Such operating memorymodules or devices may be organized according to channels, ranks, andbanks. For example, operating memory devices may be coupled toprocessing circuit 210 via memory controller 230 in channels. Oneexample of computing device 200 may include one or two DIMMs perchannel, with one or two ranks per channel. Operating memory within arank may operate with a shared clock, and shared address and commandbus. Also, an operating memory device may be organized into severalbanks where a bank can be thought of as an array addressed by row andcolumn. Based on such an organization of operating memory, physicaladdresses within the operating memory may be referred to by a tuple ofchannel, rank, bank, row, and column.

Despite the above-discussion, operating memory 220 specifically does notinclude or encompass communications media, any communications medium, orany signals per se.

Memory controller 230 is configured to interface processing circuit 210to operating memory 220. For example, memory controller 230 may beconfigured to interface commands, addresses, and data between operatingmemory 220 and processing circuit 210. Memory controller 230 may also beconfigured to abstract or otherwise manage certain aspects of memorymanagement from or for processing circuit 210. Although memorycontroller 230 is illustrated as single memory controller separate fromprocessing circuit 210, in other examples, multiple memory controllersmay be employed, memory controller(s) may be integrated with operatingmemory 220, or the like. Further, memory controller(s) may be integratedinto processing circuit 210. These and other variations are possible.

In computing device 200, data storage memory 250, input interface 260,output interface 270, and network adapter 280 are interfaced toprocessing circuit 210 by bus 240. Although, FIG. 2 illustrates bus 240as a single passive bus, other configurations, such as a collection ofbuses, a collection of point to point links, an input/output controller,a bridge, other interface circuitry, or any collection thereof may alsobe suitably employed for interfacing data storage memory 250, inputinterface 260, output interface 270, or network adapter 280 toprocessing circuit 210.

In computing device 200, data storage memory 250 is employed forlong-term non-volatile data storage. Data storage memory 250 may includeany of a variety of non-volatile data storage devices/components, suchas non-volatile memories, disks, disk drives, hard drives, solid-statedrives, or any other media that can be used for the non-volatile storageof information. However, data storage memory 250 specifically does notinclude or encompass communications media, any communications medium, orany signals per se. In contrast to operating memory 220, data storagememory 250 is employed by computing device 200 for non-volatilelong-term data storage, instead of for run-time data storage.

Also, computing device 200 may include or be coupled to any type ofprocessor-readable media such as processor-readable storage media (e.g.,operating memory 220 and data storage memory 250) and communicationmedia (e.g., communication signals and radio waves). While the termprocessor-readable storage media includes operating memory 220 and datastorage memory 250, the term “processor-readable storage media,”throughout the specification and the claims whether used in the singularor the plural, is defined herein so that the term “processor-readablestorage media” specifically excludes and does not encompasscommunications media, any communications medium, or any signals per se.However, the term “processor-readable storage media” does encompassprocessor cache, Random Access Memory (RAM), register memory, and/or thelike.

Computing device 200 also includes input interface 260, which may beconfigured to enable computing device 200 to receive input from users orfrom other devices. In addition, computing device 200 includes outputinterface 270, which may be configured to provide output from computingdevice 200. In one example, output interface 270 includes a framebuffer, graphics processor, graphics processor or accelerator, and isconfigured to render displays for presentation on a separate visualdisplay device (such as a monitor, projector, virtual computing clientcomputer, etc.). In another example, output interface 270 includes avisual display device and is configured to render and present displaysfor viewing. In yet another example, input interface 260 and/or outputinterface 270 may include a universal asynchronous receiver/transmitter(UART), a Serial Peripheral Interface (SPI), Inter-Integrated Circuit(I2C), a General-purpose input/output (GPIO), and/or the like. Moreover,input interface 260 and/or output interface 270 may include or beinterfaced to any number or type of peripherals.

In the illustrated example, computing device 200 is configured tocommunicate with other computing devices or entities via network adapter280. Network adapter 280 may include a wired network adapter, e.g., anEthernet adapter, a Token Ring adapter, or a Digital Subscriber Line(DSL) adapter. Network adapter 280 may also include a wireless networkadapter, for example, a Wi-Fi adapter, a Bluetooth adapter, a ZigBeeadapter, a Long Term Evolution (LTE) adapter, SigFox, LoRa, Powerline,or a 5G adapter.

Although computing device 200 is illustrated with certain componentsconfigured in a particular arrangement, these components and arrangementare merely one example of a computing device in which the technology maybe employed. In other examples, data storage memory 250, input interface260, output interface 270, or network adapter 280 may be directlycoupled to processing circuit 210, or be coupled to processing circuit210 via an input/output controller, a bridge, or other interfacecircuitry. Other variations of the technology are possible.

Some examples of computing device 200 include at least one memory (e.g.,operating memory 220) adapted to store run-time data and at least oneprocessor (e.g., processing unit 210) that is adapted to executeprocessor-executable code that, in response to execution, enablescomputing device 200 to perform actions.

Illustrative Systems

FIG. 3 is a block diagram illustrating an example of a system (300).System 300 may include network 330, as well as IoT support service 351,IoT devices 341-343, gateway devices 311 and 312, provisioning servicedevice 315, and application back-end 313, and module repository 319,which all connect to network 330. The term “IoT device” refers to adevice intended to make use of IoT services. An IoT device can includevirtually any device that connects to the cloud to use IoT services,including for telemetry collection or any other purpose. IoT devicesinclude any devices that can connect to a network to make use of IoTservices. IoT devices can include everyday objects such as toasters,coffee machines, thermostat systems, washers, dryers, lamps,automobiles, and the like. IoT devices may also include, for example, avariety of devices in a “smart” building including lights, temperaturesensors, humidity sensors, occupancy sensors, and the like. The IoTservices for the IoT devices can be used for device automation, datacapture, providing alerts, and/or personalization of settings. However,the foregoing list merely includes some of the many possible users forIoT services. Such services may be employed for, or in conjunction with,numerous other applications, whether or not such applications arediscussed herein. In some examples, IoT devices 341-343 and gatewaydevices 311 and 312 are edge devices, e.g., a connected device otherthan an IoT support service device or cloud back-end device, whereas IoTsupport service 351 is a cloud service and/or device.

Application back-end 313 refers to a device, or multiple devices such asa distributed system, that performs actions that enable data collection,storage, and/or actions to be taken based on the IoT data, includinguser access and control, data analysis, data display, control of datastorage, automatic actions taken based on the IoT data, and/or the like.For example, application back-end 313 may include a device or multipledevices that perform back-end functions in support of IoT services. Insome examples, at least some of the actions taken by the applicationback-end may be performed by applications running in applicationback-end 313.

The term “IoT support service” refers to a device, or multiple devicessuch as a distributed system, to which, in some examples, IoT devicesconnect on the network for IoT services. In some examples, the IoTsupport service is an IoT hub. In some examples, the IoT hub isexcluded, and IoT devices communicate with an application back-end,directly or through one or more intermediaries, without including an IoThub, and a software component in the application back-end operates asthe IoT support service. IoT devices receive IoT services viacommunication with the IoT support service.

In some examples, gateway devices 311 and 312 are each a device, ormultiple devices such as a distributed system. In some examples, gatewaydevices may be edge devices that serve as network intermediaries betweenone or more IoT devices and an IoT support service.

In some examples, provisioning service device 315 refers to a device, ormultiple devices such as a distributed system, that perform actions inprovisioning an edge device to an IoT support service.

In some examples, module repository 319 refers to a device, or multipledevices such as a distributed system, that store modules for deploymentin edge devices (e.g., IoT devices 341-343 and/or gateway devices 311and 312). In some examples, module repository 319 is not used, andmodules for deployment in the edge devices may instead be stored in IoTsupport service 351 or application back-end 313.

Each of the IoT devices 341-343, and/or the devices that comprise IoTsupport service 351 and/or application back-end 313 and/or gatewaydevices 311 and 312 and/or provision service device 315 may includeexamples of computing device 200 of FIG. 2. The term “IoT supportservice” is not limited to one particular type of IoT service, butrefers to the device to which the IoT device communicates, afterprovisioning, for at least one IoT solution or IoT service. That is, theterm “IoT support service,” as used throughout the specification and theclaims, is generic to any IoT solution. The term IoT support servicesimply refers to the portion of the IoT solution/IoT service to whichprovisioned IoT devices communicate. In some examples, communicationbetween IoT devices and one or more application back-ends occur with anIoT support service as an intermediary. The IoT support service is inthe cloud, whereas the IoT devices are edge devices. FIG. 3 and thecorresponding description of FIG. 3 in the specification illustrates anexample system for illustrative purposes that does not limit the scopeof the disclosure.

Network 330 may include one or more computer networks, including wiredand/or wireless networks, where each network may be, for example, awireless network, local area network (LAN), a wide-area network (WAN),and/or a global network such as the Internet. On an interconnected setof LANs, including those based on differing architectures and protocols,a router acts as a link between LANs, enabling messages to be sent fromone to another. Also, communication links within LANs typically includetwisted wire pair or coaxial cable, while communication links betweennetworks may utilize analog telephone lines, full or fractionaldedicated digital lines including T1, T2, T3, and T4, IntegratedServices Digital Networks (ISDNs), Digital Subscriber Lines (DSLs),wireless links including satellite links, or other communications linksknown to those skilled in the art. Furthermore, remote computers andother related electronic devices could be remotely connected to eitherLANs or WANs via a modem and temporary telephone link. In essence,network 330 includes any communication method by which information maytravel between IoT support service 351, IoT devices 341-343, and/orapplication back-end 313. Although each device or service is shownconnected as connected to network 330, that does not mean that eachdevice communicates with each other device shown. In some examples, somedevices/services shown only communicate with some other devices/servicesshown via one or more intermediary devices. Also, other network 330 isillustrated as one network, in some examples, network 330 may insteadinclude multiple networks that may or may not be connected with eachother, with some of the devices shown communicating with each otherthrough one network of the multiple networks and other of the devicesshown communicating with each other with a different network of themultiple networks.

As one example, IoT devices 341-343 are devices that are intended tomake use of IoT services provided by the IoT support service, which, insome examples, includes one or more IoT support services, such as IoTsupport service 351. IoT devices 341-343 may be coupled to IoT supportservice 351, directly, via network 330, via a gateway device (e.g.,gateway device 312), via multiple gateway devices, and/or the like.

System 300 may include more or less devices than illustrated in FIG. 3,which is shown by way of example only.

FIG. 4 is a diagram illustrating an example dataflow for a process (420)for IoT communications. FIG. 4 and the corresponding description of FIG.4 in the specification illustrates an example process for illustrativepurposes that does not limit the scope of the disclosure.

Module 431 may be one of multiple modules that compose an edgeapplication in an edge device. In some examples, the modules includingmodule 431 are re-usable, e.g., they do not depend on being in aspecific environment. Instead, the modules can be used with othercombinations of modules, e.g., to form a different application. In someexamples, each module, including module 431, has the “illusion” that itis the only module present, but, after provisioning, can communicatewith other modules, and with the IoT support service or other endpoint.In some examples, each module can act in isolation from each othermodule.

Examples of modules may include logging modules, telemetry modules,analytics modules, artificial intelligence (AI) configuration modules,management modules, sensor reader modules, function modules, and/or thelike. In some examples, each of the modules and each component in theIoT support service and other elements of the infrastructure all supporta “first-class” notion of modules. A “first-class” notion of modulesmeans that the modules and IoT support service components and otherelements of the infrastructure recognize what a module is directlywithout requiring translation when a module is referenced. In someexamples, the use of modules as a first-class notion makes inter-modulecommunication and cloud-to-module communication relatively simple afterprovisioning, because communication to a module can refer directly tothe module being communicated to. In some examples, with a first-classnotion of modules, modules can be packaged, referred to, andauthenticated, and messages can be sent to and from the modules afterprovisioning.

In some examples, each of the modules is independent. The modules can becomposed and distributed among devices in various arrangements withoutrequiring modification to the internal code of modules or of thesupporting services, including among heterogeneous devices. For example,modules can be added and/or removed from an edge application withoutrequiring modifications to the code of any of the modules.

Modules can be used in different configurations in different edgeapplications, e.g., so that one module can be reused among manydifferent edge applications by composing applications from differentcombinations of modules. In some examples, each module has, in effect,the “illusion” that it is a complete application, and does not have totake into account what else is happening on the device. Each module canact in isolation from other modules on the same device. Declarativecommunication can be defined to and from individual modules, for examplebetween two modules and/or between a module and a cloud service. In someexamples, the modules are reusable across application or othersolutions. Modules that compose an edge application may also be built bydifferent parties.

In some examples, an edge application may be composed of modules and anedge runtime functionality. In some examples, the edge runtimefunctionality may itself also be a module. In some examples, the runtimefunctionality may perform module management functions such asconfiguration modules, performing per-module logs and metrics,communication routing between modules and between modules on the cloud,managing offline capabilities of the edge device, assist in thedeployment of modules at the direction of the IoT support service,and/or the like.

In some examples, module 431 and provisioning service 411 have thefollowing starting point. First, the edge IoT device that includesmodule 431 stores the endpoint it is to connect with in order to beautomatically provisioned. For instance, the endpoint uniform resourceindicator (URI) may be installed in the factory. In some examples, onfirst power-up and first boot-up, module 431 is cryptographicallyguaranteed to connect to provisioning service 411. Also, the edge devicethat includes module 431 stores identity information about itself aswell as optional metadata, which may include geolocation, in someexamples. Further, provisioning service 411 may have some method toverify the identity of module 431. The source used to verify theidentity of module 431 may provide provisioning service 411 withadditional metadata. Provisioning service 411 may also contain a ruleengine used to route a module's provisioning request to the correct IoTsupport service. For example, one rule may be for all modules for alledge devices within a certain geographic region to be provisioned to anIoT solution located in a certain region. Provisioning service 411 maybe configured with information about how to connect a module to one ormore IoT support services each corresponding to a separate IoT solution.

In the illustrated example, upon the edge device including module 431first being powered on by a customer, step 421 occurs. At step 421, anidentification message may be communicated from module 431 toprovisioning service 411. The identification message, along with variousother communicated messaged discussed herein, may be secured usingcryptographic techniques. In some examples, module 431 communicates theidentification message directly to provisioning service 411. In otherexamples, the identification message is communicated from module 431 toprovisioning service 411 through one or more intermediary devices, suchas a mobile provisioning application device, cloud-to-cloud identityattester, or the like, as discussed in greater detail below.

In some examples, the edge device that include module 431 ismanufactured with the URI of provisioning service 411. In some of theseexamples, step 421 happens upon the edge device that includes module 431first being powered on. Upon the edge device including module 431 firstbeing powered on, module 431 may send the identification message toprovisioning service 411 via the URI of provisioning service 441.

The identification information may include information that is usablefor verifying that module 431 is a valid module to receive IoT services,and may also include information for determining which IoT solution isappropriate for module 431, such as geographical information.

As shown, step 422 occurs next. At step 422, in some examples, theprovisioning service determines whether or not module 431 is valid. Thevalidity determination may be made in different ways in differentexamples, which will be discussed in greater detail below. In someexamples, if the provisioning service determines that module 431 is notvalid, the process ends.

If, instead, provisioning service 411 determines that module 431 isvalid, step 423 occurs. At step 423, in some examples, provisioningservice 411 selects an IoT support service from a plurality of IoTsupport services. In some examples, the selection of the IoT supportservice is based on routing rules. In some examples, geographicallocation may be a factor in the selection of the IoT support service.For example, the closest appropriate IoT support service may be selectedin some examples. Another factor in the selection of the IoT supportservice may be dependent on which IoT solution is appropriate based onfactors relevant to the IoT device and determined by the IoT devicemanufacturer. For example, all smart building IoT devices from amanufacturer may use a particular IoT solution and therefore select thecorresponding IoT support service, while smart toasters from thatmanufacturer may go to a different IoT solution and therefore select thecorresponding IoT support service.

In this example, step 424 occurs next. At step 424, a request toregister module 431 may be communicated from provisioning service 411 tothe selected IoT support service (IoT support service 451). In someexamples, the request to register module 431 includes connectioninformation associated with module 431. Next, step 425 occurs. At step425, IoT support service 451 may register module 431 in a registry inIoT support service 451. As part of the registration at step 425, insome examples, IoT support service 451 creates a separate identifier formodule 431. In some examples, by creating a separate identifier formodule 431, IoT support service has an identifier for module 431 thatmaps to module 431 so that IoT support service 451 can properlycommunicate with module 431.

Although not shown in FIG. 4, in some examples, next, cryptographicinformation about module 431 is communicated from IoT support service451 to provisioning service 411, and in turn the cryptographicinformation about module 431 is communicated from provisioning service411 to module 431. As part of this communication, IoT support service451 may queue up commands for module 431, or queue up commands to besent for module 431 to complete subsequently. This completes theprovisioning process in this example. The cryptographic information mayalso include credentials, the hostname of the selected IoT supportservice 451, connectivity information required for module 431 to connectwith IoT support service 451, and the like. In some examples,credentials are not on the edge device that includes the module, andinstead the device has a hardware root of trust that is used forcreating trust in edge device that includes the module. In otherexamples, the provisioning process completes in some other manner, or iscomplete with step 425.

After provisioning is complete, in some examples, communications betweenmodule 431 and IoT support service 451 may occur directly and in anormal fashion, and provisioning service 411 are not again involved incommunications between module 431 and IoT support service 451, unless,in some examples, module 431 needs to be re-provisioned. In someexamples, module 431 sends an initial message to IoT support service451, such as a welcome packet or the like, and IoT support service 451returns a message to module 431 with steps that module 431 needs tofollow before module 431 may begin sending data to IoT support service451.

In some examples, module 431 retains cryptographic memory ofprovisioning service 411 and can be redirected to provisioning service411 during the lifetime of module 431 in order to re-provision IoTdevice 411. In some examples, certain events may cause module 431 toinitiate re-provisioning, such as the edge device including module 431being resold, a change in geographical regions, or the like.

In some examples, re-provisioning of an IoT device may be performed asfollows. First, a determination is made as to which new IoT supportservice the IoT device should be attached to (in base data). Next, theIoT device is provisioned in the new IoT support service. Then, the newconnection information is returned. The IoT device is then deleted fromthe registry of the old IoT support service.

In some examples, as a security measure, provisioning service 411 may berestricted from directly connecting to a device without first beingcontacted by that device. In other examples, provisioning service 411can directly connect to module 431 without being contacted by module431, and the security is ensured in some other manner.

Although FIG. 4 discusses in an example in which each module isprovisioned individually, in other examples, the device may instead beprovisioned as a whole, and then each module communicates to the cloudsecurely based on the security context provided by the provisioning andby the edge device hardware security. Similarly, in the examples givenin FIGS. 5-9 that follows, in some examples, each module may beprovisioned separately, or the device may be provisioned as a whole witheach module communicated to the cloud via the security context providedby the provisioning and by the edge device hardware security.

FIG. 5 is a block diagram illustrating an example of a portion (501) ofsystem 300 of FIG. 3. Portion 501 includes edge device 541, provisioningservice 511, and IoT support services 551 and 552. As shown,provisioning service 511 includes routing rules 591 and enrollment list592. Also, IoT support service 551 includes registry 593 and IoT supportservice 552 includes registry 594.

In some examples, edge device 541 is manufactured with the URI ofprovisioning service 511 installed therein.

In some examples, edge device 541 is also manufactured withidentification information for edge device 541 installed therein. Insome of these examples, edge device 541 is also manufactured with othermanufacturer set data. The identification information may include thedevice identity (ID), the manufacturer set data, and, in some examples,base data including other information that may be relevant in terms ofselecting an IoT solution, such as geographical data. In some examples,the device identifier is known by the manufacturer of the device.

In some examples, the manufacturer makes a list of device ideas for edgedevices eligible to use the IoT services available to provisioningservice 511 via an uploaded file, or the like, so that the deviceidentifier of each edge device can be validated.

At step 5-1, edge device 541 contacts the provisioning service endpoint(of provisioning service 511) set at the factory. The device identifierand, optionally, other manufacturer-set data are passed as part of thecall.

Next, at step 5-2, provisioning service 511 ascertains the validity ofedge device 541 by validating the device identifier and, optionally,other manufacturer-set data against the uploaded base data. In someexamples, provisioning service 511 also looks up edge device 541 in thesource of base data to find out metadata/hub data about edge device 541if such data is present.

The validation at step 5-2 may be performed in different ways indifferent examples. In some examples, enrollment list 592 may includeall devices built by a manufacturer that uses one or more IoT solutionsassociated with the provisioning service that have been programmed withprovisioning service 511 as the endpoint to use on first boot up. Inother examples, enrollment list 592 may include only devices sold, notall devices built, that use provisioning service 511 as the endpoint forprovisioning. In some examples, provisioning service 511 verifies theidentity by determining whether or not the provided device identifier isa device identifier included in enrollment list 592. In some examples,other steps are necessary to confirm the device identity. For example,other data provided by edge device 541 may also be used in theverification.

Next, at step 5-3, provisioning service 511 runs routing rules over thedata from edge device 541 as well as data from the base data source tofind the right IoT support service to register edge device 541 with.Provisioning service 511 registers edge device 541 with the selected IoTsupport service's (551) registry.

Next, at step 5-4, IoT support service 551 returns cryptographicinformation about edge device 541 to provisioning service 511.

Next, at step 5-5, provisioning service 511 returns the cryptographicinformation to edge device 541.

Modules in edge device 541 can now send data directly to IoT supportservice 551 at step 5-6.

Next, at step 5-7, the metadata of edge device 541 syncs with themetadata stored in the IoT support service's (541) registry.

FIG. 6 is a block diagram illustrating an example of a portion (601) ofsystem 300 of FIG. 3. Portion 601 includes edge device 641, provisioningservice 611, trusted mobile provisioning application (MPA) device 619,and IoT support services 651 and 652. As shown, provisioning service 611includes routing rules 691. Also, IoT support service 651 includesregistry 693 and IoT support service 652 includes registry 694.

In some examples, edge device 641 is manufactured with a secure deviceidentity available via NFC or similar technology. In the exampleillustrated in FIG. 6, this is the root of trust of edge device 641.

In some examples, edge device 641 is also manufactured with additionalinformation available via NFC or similar technology, and a programmableinterface to uploading IoT Hub device credentials onto edge device 641.

In some examples, trusted mobile provisioning application device 619 hasa method of reading the device identity of the device via NFC or similartechnology, and a way to input additional metadata about the device,such as floor within a building. In some examples, trusted mobileprovisioning application device 619 also has a trusted connection toprovisioning service 611.

In some examples, the MPA operator enters metadata about the edge device641 into MPA device 619 before initializing provisioning.

At step 6-1, MPA device 619 scans edge device 641 during installation.

Next, at step 6-2, MPA device 619 contacts the provisioning serviceendpoint (of provisioning service 611) with information from the edgedevice (641) scan as well as information input by the MPA operator.

Next, at step 6-3, provisioning service 611 ascertains the validating ofthe MPA connection. Provisioning service 611 runs routing rules over thedata from MPA device 619 to find the right IoT support service toregister edge device 641 with. Provisioning service 611 registers edgedevice 641 with the IoT support service's (651) registry.

Next, at step 6-4, IoT support service 651 returns cryptographicinformation about edge device 641 to provisioning service 611.

Next, at step 6-5, provisioning service 611 returns the cryptographicinformation to MPA device 619.

Next, at step 6-6, MPA device 619 passes the cryptographic informationalong to edge device 641 via the programmable interface of edge device641.

Modules in edge device 641 can now send data directly to IoT supportservice 651 at step 6-7.

Next, at step 6-8, the metadata of edge device 641 syncs with themetadata stored in the registry of IoT support service 651.

Although not shown in FIG. 6, some examples of portion 601 may be usedfor cloud-to-cloud implementations with cloud-to-cloud device identityattestation. In some examples, the example illustrated in FIG. 6 anddiscussed above is functionally equivalent to what is required for C2Cdevice identity attestation providers to connect their systems to IoTservice, replacing “mobile provisioning application device” with“Cloud-to-cloud identity attester.”

FIG. 7 is a block diagram illustrating an example of a portion (701) ofsystem 300 of FIG. 3. Portion 701 includes edge device 741, provisioningservice 711, source of base data 771, and IoT support services 751 and752. As shown, provisioning service 711 includes routing rules 791.Also, IoT support service 751 includes registry 793 and IoT supportservice 752 includes registry 794.

In some examples, a private key (from the private/public key pair) isstored in edge device 741 in secure storage on edge device 741 (viaTrusted Platform Module or other similar technology). In the exampleillustrated in FIG. 7, this is the root of trust of edge device 741.

Also, in some examples, edge device 741 stores an X509 certificatecontaining the URI of provisioning service 711. In some examples, theX509 certificate also contains the device identifier of edge device 741and other device metadata for edge device 641.

The signature of the X509 certificate is accomplished using the privatekey in a secure process. In some examples, the X509 certificate isgenerated at provisioning time, and in other examples, the X509certificate is generated at manufacture time. The public key (from theprivate/public key pair) is made available to the provisioning serviceto validate the certificate signature.

At step 7-1, edge device 741 contacts the endpoint of provisioningservice 711, where the endpoint is set at the factory. The end point isextracted from the X509 certificate, and the signature along with theX509 certificate are passed as part of the call.

At step 7-2, provisioning service 711 ascertains the validating of theX509 certificate by calculating the signature using the public key andcomparing with the supplied signature. Provisioning service 711 alsolooks up the edge device 741 in the source of base data to find outmetadata/hub data about the edge device 741.

At step 7-3, provisioning service 711 runs routing rules over the datafrom edge device 741 as well as data from the base data source to findthe right IoT support service to register edge device 741 with.

At step 7-4, provisioning service 711 registers edge device 741 with theregistry of IoT support service.

At step 7-5, IoT support service 751 returns cryptographic informationabout edge device 741 to provisioning service 711.

At step 7-6, provisioning service 711 returns the cryptographicinformation to edge device 741. All subsequent calls are between modulesin edge device 741 and IoT support service 751.

At step 7-7, modules in edge device 741 can now send data to IoT supportservice 751.

At step 7-8, the metadata of edge device 741 syncs with the metadatastored in the registry of IoT support service 751.

FIG. 8 is a logical flow diagram illustrating an example of a process(880) for IoT communications. After a start block, the process proceedsto block 881. At block 881, in some examples, an identification messageis received. The identification message may include informationassociated with identification of a module on a first edge device. Theprocess then moves to block 882. At block 882, in some examples, thevalidity of the module is verified. In some examples, verifying validityof the first edge device includes at least one of: checking a deviceidentification in the identification information against an enrollmentlist, validating a mobile provisioning application (MPA) connection fromwhich the identification information was received, validating acloud-to-cloud identity attester connection from which theidentification information was received, or validating a certificate inthe identification information.

The process then moves to block 883. At block 883, in some examples,based at least in part on the identification message, an IoT supportservice is selected from a plurality of IoT support services. That is,in some examples, a determination of an IoT support service from aplurality of IoT support services to be associated with the module ismade based at least in part on the identification message. The processthen advances to block 884. At block 884, in some examples, the moduleis caused to be registered with the selected IoT support service. Themodule may be one of a plurality of modules that are compositabletogether into an application for the edge device. In some examples, themodules of the plurality of modules are capable of being usedinteroperably with other modules without altering the other modules. Theprocess then proceeds to a return block, where other processing isresumed.

FIG. 9 is a logical flow diagram illustrating an example of a process(985) for IoT communications. After a start block, the process proceedsto block 986. At block 986, in some examples, a registry is created. Theprocess then moves to block 987. At block 987, in some examples, arequest is received to register a module from a provisioning service,based on network communications between the provisioning service and theIoT support service, such that a hostname of the provisioning service isa second hostname, the hostname of the IoT support service is the firsthostname, and such that the second hostname is different from the firsthostname.

The process then advances to block 988, where the module may be added tothe registry. The process then proceeds to block 989, where, in someexamples, cryptographic information associated with the module istransmitted. The process then moves to a return block, where otherprocessing is resumed.

The provisioning service may enable, for each module, the “seamless”creation of its digital twin in IoT services. The digitals twins of themodules may be referred to as module twins. In some examples, themodules twins each serve as a “cloud representation” of a correspondingmodule. In some examples, each module twin is a set of securely isolatedprimitives comprising communication and state synchronizationprimitives. In some examples, each module twin includes metadata aboutthe corresponding module, such as what type of module it is, variousinformation about the module, as well as relevant information about thedevice that the module is in (e.g., type of device, capabilities,location, and/or the like, where relevant to the module). In someexamples, at least a portion of each module twin is synchronized withthe corresponding module. In some examples, the module twins arequeryable, and can be used in the answering of queries about thecorresponding module. For instance, a query could be made to determinewhich smart locks in a room are locked, which smart lights in the roomare on, or what the temperature is in the room, and the relevant modulecould respond with the appropriate information.

Each module twin may have its own separate telemetry channel to itscorresponding module. When modules are added or removed from devices,the IoT support service may be updated accordingly by adding or removingthe corresponding module twins, for example, automatically. In someexamples, there may be numerous edge devices, and the IoT supportservice may store a corresponding module twin for each module of eachedge device.

The IoT support services may include services that may perform variousfunctions in the IoT support service. The services may be capable ofcommunication with each other, with other components in the IoT supportservice, with modules twins, and with modules. The services may include,for example, analytics services, portable translation services, logicservices, telemetry components service, module management services,and/or the like.

In some examples, an edge application may be composed of modules and anedge runtime functionality. In some examples, the edge runtimefunctionality may itself also be a module. In some examples, the runtimefunctionality may perform module management functions such asconfiguration modules, performing per-module logs and metrics,communication routing between modules and between modules on the cloud,managing offline capabilities of the edge device, assist in thedeployment of modules at the direction of the IoT support service,and/or the like.

As discussed above, in some examples, each module in an applicationshares the same security context via the provisioning service and by theedge device hardware security. As discussed above, in some examples,each module is separately provisioned, and in another example, thedevice is provisioned with each of the modules communicated with thecloud based on the security context provided by the provisioning serviceand by the edge device hardware security.

As discussed above, modules twins may store information about themodule, including properties of the module, and of the device that themodule is in where relevant. A module twin may include the type ofmodule, type of device that the module is in where relevant to themodule, various properties of the module and various relevant propertiesof the device that the module is in, capabilities of the module, and/orthe like. The exact properties stored in the module twin may depend onthe type of module. For example, a temperature sensor module of a devicemay store the current temperature as determined by the module. A moduletwin associated with the function of a smart device may store thestatus—for example, whether a smart lock is locked or unlocked, whethera smart light is on or off, and/or the like. At least a portion of theinformation in the module twin may be synchronized based on the moduleby updating the information in the module twin based on the module.Also, information in the module twin may be queryable.

In some examples, module twins may include at least tags and properties.In some examples, the properties may include reported properties anddesired properties.

In some examples, reported properties indicate the properties of themodule as reported to the IoT support service. For example, for an IoTdevice that is a lock, the module twin associated with a module for thelocking function of the smart lock may have a corresponding propertyindicating whether the reported status is locked or unlocked. In someexamples, a desired property indicates the status that the property thatthe actual device should have at that time. The desired property may bethe same as or different than the reported property. If the desiredproperty is different than the corresponding reported property, actionsmay be taken to resolve the discrepancy.

Some devices may not always be connected, and may instead, for example,connect to the network only a few times per day, or in the case of anerror. In these example, data may be buffered locally, and a specificevent may trigger a connection and a data upload. Modules twins may thenupdate when a connection occurs. Accordingly, in the case of anintermittently connecting device, a module twin may not be up-to-dateuntil a connection occurs.

In some examples, the IoT support service can deploy modules to edgedevices. The deployment may be done for a number of different reasons.For example, modules may be deployed to configure applications on edgedevices based on circumstances, to add new functionality to existingedge devices, for the deployment of applications on new edge devices,and/or the like.

For example, modules may be deployed to configure applications on edgedevices based on circumstances. For example, it may be determined that aconsiderable amount of telemetry is coming from a particular IoT devicethat connects to the IoT support service through a gateway. In response,the IoT support service could deploy a module to the gateway thataggregates the telemetry data. The IoT support service could also oralternately deploy an analytics module to the gateway, where theanalytics module performs analytics on the telemetry data, so that theanalytics can be done at the gateway rather than sending all of thetelemetry data to the cloud. Accordingly, deploying modules to edgedevices may be used to configure applications on edge devices on anas-needed or other basis.

Deployment of modules can also be used to add new functionality to anexisting edge device. For example, artificial intelligence can be addedto an existing edge device. As another example, a thermostat may havebeen previously adjustable by voice commands, and remotely adjustable,e.g., over a network. The IoT support service could add deploy a machinelearning module to the themostat, e.g., so that the themostat couldadjust itself based on machine learning. Similarly, IoT support servicecould deploy a facial recognition module to a camera that did notpreviously have facial recognition capabilities. If a room contained (1)a connected device capable of receiving voice commands, and (2)connected devices without native voice capability, the IoT supportservice could provide modules to the connected device without nativevoice capability and thus enable that connected devices to respond tovoice commands.

Deployment of modules can also be used for new edge devices. When a newedge device is provisioned, or placed into a particular environment forthe first time, the IoT support service may detect the edge device, and,in response, deploy the modules appropriate for the environment in whichnew edge device is placed. For example, if the motion sensors in aparticular room are configured in a certain way with certain module, anda new motion sensor is placed in the room, the IoT support service canconfigure the new motion sensor with modules similar to the othermotions sensors in the room.

In this way, edge devices need not include any code other than that forprovisioning and responding to deployment instructions from the IoTsupport service. The edge devices need not have any code for performingtheir particular functions and/or have any IoT functionality, untilafter the code is caused to be deployed thereto by the IoT supportservice. In this way, a customer can buy a “vanilla” connected devicethat does not include code for performing the “intended” functions ofthe device. Instead, in some examples, the edge device will connect tocloud, and the IoT support service will deploy the modules for suchfunctionality to the edge device.

When new modules are deployed to an edge device, in some examples, thenew modules may be provisioned in a manner discussed above, or, in otherexamples, rather than provisioning occurring for the new module(s), thenew module(s) may make use the provisioning already performed by thedevice for secure communications from the new module(s) to the cloud.

The IoT support service may indirectly deploy the modules to the edgedevices, in some examples. For instance, the IoT solution may send, tothe edge device to which the modules are to be deployed, a command todownload the modules from a module repository. In other examples, theIoT support service may directly send the modules to the edge device.For example, module repository 419 may be omitted from some systems. Inother examples, the IoT support service may send, to the edge device towhich the modules are to be deployed, a command to download the modulesfrom a module repository, such as module repository 419 of FIG. 4.

When deploying modules, in some examples, the IoT support servicedetermines one or more modules to be deployed and identifies edge deviceto which to deploy the determined modules. The IoT support service maythen cause the determined modules to be deployed to the identified edgedevice. The IoT support service may also update the module twins basedon the deployed modules, so that each of the deployed modules has acorresponding module twin stored in the IoT support service.

In some examples, the deployment of modules to the edge devices isdriven by the cloud. In some examples, the IoT support service itselfdrives the deployment of the modules to the edge devices. In someexamples, deployment of the modules may be based on rules in the IoTsupport service, and in other examples, the set of modules required inparticular edge devices may be determined by an IoT solution operatorand communicated to the IoT support service. The IoT support servicecould then deploy the modules accordingly. In other examples, a back-endapplication in the application back-end may drive deployment of modulesto the edge devices.

Cloud deployment of modules to edge devices may have many benefits,including re-use of code. Some functionality may be re-used across manydifferent solution and types of devices. For example, the sameartificial intelligence module may be re-usable across many types ofsolutions and/or across many types of edge devices. Similarly, the sameanalytics module may be reusable across many types of solutions and/oracross many types of edge devices. In these examples, the same modulewith the same code can be deployed to many different edge devices, whichmay include different types of edge devices, without requiringmodification of the code in the modules deployed or in the other modulesalready present in the edge devices to which the modules are deployed.

Illustrative Processes

For clarity, the processes described herein are described in terms ofoperations performed in particular sequences by particular devices orcomponents of a system. However, it is noted that other processes arenot limited to the stated sequences, devices, or components. Forexample, certain acts may be performed in different sequences, inparallel, omitted, or may be supplemented by additional acts orfeatures, whether or not such sequences, parallelisms, acts, or featuresare described herein. Likewise, any of the technology described in thisdisclosure may be incorporated into the described processes or otherprocesses, whether or not that technology is specifically described inconjunction with a process. The disclosed processes may also beperformed on or by other devices, components, or systems, whether or notsuch devices, components, or systems are described herein. Theseprocesses may also be embodied in a variety of ways. For example, theymay be embodied on an article of manufacture, e.g., asprocessor-readable instructions stored in a processor-readable storagemedium or be performed as a computer-implemented process. As analternate example, these processes may be encoded asprocessor-executable instructions and transmitted via a communicationsmedium.

Conclusion

While the above Detailed Description describes certain examples of thetechnology, and describes the best mode contemplated, no matter howdetailed the above appears in text, the technology can be practiced inmany ways. Details may vary in implementation, while still beingencompassed by the technology described herein. As noted above,particular terminology used when describing certain features or aspectsof the technology should not be taken to imply that the terminology isbeing redefined herein to be restricted to any specific characteristics,features, or aspects with which that terminology is associated. Ingeneral, the terms used in the following claims should not be construedto limit the technology to the specific examples disclosed herein,unless the Detailed Description explicitly defines such terms.Accordingly, the actual scope of the technology encompasses not only thedisclosed examples, but also all equivalent ways of practicing orimplementing the technology.

We claim:
 1. A method, comprising: forming a first edge application of aplurality of edge applications on a first edge device by recombining aplurality of modules, wherein the plurality of modules comprises a firstmodule that was a modular component of a second edge application and asecond module that was a modular component of a third edge application,and wherein each of the first edge application, the second edgeapplication, and the third edge application are different applications;and via at least one processor, for each module of the plurality ofmodules, causing a provisioning of that module on a per-module basis,including: responsive to power-on of the first edge device, determiningan identifier associated with a provisioning service; communicating anidentification message from that module to the provisioning servicebased on the determined identifier; and receiving cryptographicinformation associated with the provisioning of that module.
 2. Themethod of claim 1, wherein the identification message includes a deviceidentification associated with the first edge device and geographicalinformation associated with the first edge device.
 3. The method ofclaim 1, wherein the identifier includes a Uniform Resource Identifier(URI) associated with a provisioning service endpoint of theprovisioning service.
 4. The method of claim 1, the plurality of edgeapplications on the first edge device further include a fourth edgeapplication comprising a third module and a fourth module.
 5. The methodof claim 1, wherein forming the first application by recombining theplurality of modules is accomplished without modifying code of any ofthe plurality of modules.
 6. The method of claim 1, further comprising,for each module of the plurality of modules, after receiving thecryptographic information associated with the provisioning of thatmodule, synchronizing that module with metadata stored in a module twinthat is associated with that module.
 7. The method of claim 1, whereinfor each module of the plurality of modules, the cryptographicinformation includes connectivity information associated with thatmodule.
 8. The method of claim 1, wherein for each module of theplurality of modules, the cryptographic information includes credentialsfor that module.
 9. The method of claim 1, wherein for each module ofthe plurality of modules, the cryptographic information includes ahostname of an IoT support service selected for that module.
 10. Anapparatus, comprising: a device including at least one memory adapted tostore run-time data for the device, and at least one processor that isadapted to execute processor-executable code that, in response toexecution, enables the device to perform actions, including: recombininga plurality of modules to form a first edge application of a pluralityof edge applications on a first edge device, wherein the plurality ofmodules comprises a first module that was a modular component of asecond edge application and a second module that was a modular componentof a third edge application, and wherein each of the first edgeapplication, the second edge application, and the third edge applicationare different applications; and for each module of the plurality ofmodules, causing a provisioning of that module, including: causing acommunication an identification message associated with that module tobe sent to a provisioning service, based, in part, on an identifierassociated with the provisioning service; and receiving cryptographicinformation associated with the provisioning of that module based, atleast in part, on the communication.
 11. The apparatus of claim 10,wherein the identification message includes a device identificationassociated with the first edge device and geographical informationassociated with the first edge device.
 12. The apparatus of claim 10,wherein the identifier includes a Uniform Resource Identifier (URI)associated with a provisioning service endpoint of the provisioningservice.
 13. The apparatus of claim 10, wherein recombining theplurality of modules to form the first edge application is accomplishedwithout modifying code of any of the plurality of modules.
 14. Theapparatus of claim 10, the actions further including, for each module ofthe plurality of modules, after receiving the cryptographic informationassociated with the provisioning of that module, synchronizing thatmodule with metadata stored in a module twin that is associated withthat module.
 15. The apparatus of claim 10, wherein for each module ofthe plurality of modules, the cryptographic information includesconnectivity information associated with that module, credentials forthat module, and a hostname of an IoT support service selected for thatmodule.
 16. A processor-readable storage medium, having stored thereonprocessor-executable code that, upon execution by at least oneprocessor, enables actions, comprising: reusing a plurality of modulesto form a first edge application of a plurality of edge applications ona first edge device, wherein the plurality of modules comprises a firstmodule that was a modular component of a second edge application and asecond module that was a modular component of a third edge application,and wherein each of the first edge application, the second edgeapplication, and the third edge application are different applications;and for each module of the plurality of modules, causing a provisioningof that module on a per-module basis, including: responsive to apower-on of the first edge device, determining a Uniform ResourceIdentifier (URI) associated with a provisioning service; causing acommunication an identification message associated with that module tobe sent to the provisioning service; and receiving cryptographicinformation associated with the provisioning of that module.
 17. Theprocessor-readable storage medium of claim 16, wherein theidentification message includes a device identification associated withthe first edge device and geographical information associated with thefirst edge device.
 18. The processor-readable storage medium of claim16, wherein reusing the plurality of modules to form the first edgeapplication is accomplished without modifying code of any of theplurality of modules.
 19. The processor-readable storage medium of claim16, the actions further comprising, for each module of the plurality ofmodules, after receiving the cryptographic information associated withthe provisioning of that module, synchronizing that module with metadatastored in a module twin that is associated with that module.
 20. Theprocessor-readable storage medium of claim 16, wherein for each moduleof the plurality of modules, the cryptographic information includesconnectivity information associated with that module, credentials forthat module, and a hostname of an IoT support service selected for thatmodule.